T1020 Automated Exfiltration

Technique

T1020

Tactics

Exfiltration

Research, 90 days

2

KEV CVEs mapped

0

SigmaHQ rules

10

Elastic, Splunk

9

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1020

MITRE description

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
• 2026-10-19 Rapid7: Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Detection coverage

SigmaHQ community rules

• Mail Forwarding/Redirecting Activity In O365 (threat-hunting)
• Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet (threat-hunting)
• Github Fork Private Repositories Setting Enabled/Cleared (core)
• Github Repository/Organization Transferred (core)
• AWS RDS Master Password Change (core)
• Modification or Deletion of an AWS RDS Cluster (core)
• Restore Public AWS RDS Instance (core)
• Suspicious Inbox Forwarding (core)
• PowerShell Script With File Hostname Resolving Capabilities (core)
• PowerShell Script With File Upload Capabilities (core)

Elastic and Splunk rules

• AWS EC2 Full Network Packet Capture Detected (elastic)
• GitHub Private Repository Turned Public (elastic)
• GitHub Exfiltration via High Number of Repository Clones by User (elastic)
• High Number of Closed Pull Requests by User (elastic)
• Several Failed Protected Branch Force Pushes by User (elastic)
• High Number of Protected Branch Force Pushes by User (elastic)
• M365 OneDrive/SharePoint Excessive File Downloads (elastic)
• Detect RClone Command-Line Usage (splunk)
• Windows Mustang Panda USB Tool Execution (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.